Malware leeching BW and running up bills ?

Hey there,

Just yesterday I had two clients call in and say there Telephone bill was R13000 (Um around $2000) when it is normally R850 ($100). Their ISP said they had spyware and or malware. The other client said their BW cap ran out in 2 days even though they jsut use Email. And their ISP said it was malware.

They called here and I jsut wasnt convinved that it was spyware / malware. Is this a reality and can this happen to a home user? I would assume these targeted malware attacks would target companies with unlimited BW , not a home user with a 3G cap and someone on 3G.

I told them to get the logs from the ISP.

Any advice on this?

In my experience malware is anything but "targeted". You pick up one trojan horse along the way and it lets all of its buddies in the back door. Before you blink three times your hard drive is loaded up with crap trying to phone home with all sorts of information. I'd say it's conceivable.

Side story: I once ran McAfee AV via command line outside of Windows and it was removing viruses for three days, the screen constantly scrolling at warp speed the entire time listing the stuff it removed. The machine was running Windows 98 and the user was accessing the internet via AOL dialup... This was a little over a year ago. People just pick up random crap sometimes.

Hey there, Sounds wicked :)

What exactly do you mean outside of windows - from the command line?

I believe he means from a DOS boot disk, running a scan on the harddrive...

I prefer to use Boot CD's that either create a Physical Environment similar to an OS but not installed on the HDD, just running straight from the RAM or just run the scan from the CD prior to booting into Windows. Make any sense? It's more efficient to scan the entire HDD because if you're booted into Windows, there are a lot of files currently being used by something else that you will not be able to scan (or at least modify) with antivirus software.

Hi there,

Well which AV software will scan out side of windows and if it finds anything will disinfect or delete.

I know the software I got can scan but cannot disinfect. Real bummer.

Have them check their dial-up and network connections. See if
there's more than one. Back in the ol' days (early-2000's) when
dial-up was prevalent here in the States, some malware would
create new dial-ups, hooking into 900 (pay) numbers. I've seen
phone bills jump like you're describing on 'phony' connections.

Just a thought.

There are only three AV scanners I know of that can disinfect from the command line. F-Prot, McAfee, and Trend Micro. I'm sure there are others.

As for scanners that can disinfect from a PE (physical environment), there are many. All the conventional antispyware/antivirus programs I know of work in a PE.

Yes they will work from command line but it depends on how your hard drive is formatted to make the scans work from a bootable CD. NTFS is tricky since you have to load a read/write driver and then do a scan.

Yeah , well most PC's are ntfs these days arent they?

Quote:

---

Originally Posted by oofki

Yes they will work from command line but it depends on how your hard drive is formatted to make the scans work from a bootable CD. NTFS is tricky since you have to load a read/write driver and then do a scan.

---

Dunno why NTFS should be a issue..
You Have the Window's Preinstalled Environment (Win-PE) Cd's aka Winbuilder and Bart PE .. these have no issues with NTFS.. have worked well for me for over 4 years.. and with tools for (remote) registry editing. not only do you get the malware files .. but you also get to hit the registry entries that say.. "If my files deleted..redownload from one of these sites"..

While not a Linux user for windows system recovery.. the various OS live CD's have been reporting excellent results with NTFS.. I have not worked with these because of the registry editing factor (If someone tells me there is a *nix Live OS app that supports Windows remote registry editing let me know)

Regarding Ciders Issue;
@Cider
What was the problem with the Phone account? was it Calls? or Data Usage?
If it's Calls.. then yes look for Diallers (Spybot SnD used to do an excellent job against them)
If its Data.. then you're looking for a SPAM worm (spyware is not so obvious on the BW usage.. noticable but not that obvious)

As for NTFS usage.. My impression is that All Vista Installs are NTFS.. BUT with XP.. some OEM's were still lumbering people with FAT32 partitions

Quote:

---

Originally Posted by Und3ertak3r

As for NTFS usage.. My impression is that All Vista Installs are NTFS.. BUT with XP.. some OEM's were still lumbering people with FAT32 partitions

---

NTFS is used more these days, but i regulary have machines come in or go to site's with machines still using fat32.

seems some legacy apps just don't want to play nicely with ntfs and ceo's would rather spend the money funding the next business trip then to get some coder in to update software. :rolleyes:

I was talking about using it from DOS since some one brought it up, Win-PE is not command line.

Quote:

---

Originally Posted by oofki

I was talking about using it from DOS since some one brought it up, Win-PE is not command line.

---

Well not completely true... Win-PE IS command line...well scripted tool.. But the CD you create using that tool can be CLI or Gui..depends on how you setup your PE disk.. it can be completely Command line or operated from from GUI.. depends on the person setting it up.. .. mind many people setting up their PE disks will set it to be usable with a GUI.. so in the general tense your correct..

As for DOS.. haven't used DOS as in DOS 6 for 4 or 5 years.. but I had a early Live CD with NTFS drivers lifted from a WIN2k install along with a brace of DOS apps.. and some NT command line tools for working with NT based pc's... quickly found it easier to build my live cd's with the PE builder and use XP command line tools..(some of hose could be traced back to the DOS tools)
Just never found it to be flakey at all.. only early *Nix NTFS drivers were hit and miss..